7 ms·
T-Mobile Breached, Again
- aww_dang 4y agoMeanwhile services everywhere are happy to demand phone numbers, SMS verification to login or create accounts.
- jakebasile 4y agoMaybe it's time for me to move providers. This is getting ridiculous, and their service in my area isn't that stellar anyways. It's just a hassle to move so I stay because of inertia (read: laziness).
- kaycebasques 4y agoSame. Which provider has the best security track record? I.e. which one has been hacked the least?
- SkyMarshal 4y agohttps://blog.kraken.com/post/219/security-advisory-mobile-phones/ https://blog.kraken.com/post/219/security-advisory-mobile-ph...
- kapperchino 4y agoYour info probably has been leaked already, so it’s out there, won’t matter if it leaks again lol
- kibwen 4y agoMaybe it's time to regulate privacy to make the retention of personally-identifying information illegal for companies that have no need to retain it. PII should be considered legally radioactive. There's no excuse for a mere wireless carrier to need your SSN.
- fooqux 4y agoOr maybe it's time to do away with SSN as a form of authentication. If there is a single person in the US that hasn't had theirs be stolen by now, I'd be shocked. I can revoke a cert that has been compromised. I don't understand why we don't have a similar procedure set up for my PII.
- koolba 4y agoT-Mobile does not require any identification to get a prepaid phone line. You can submit whatever name you'd like for the line. There's no SSN requested either. Any requirements imposed at a local store are specific to your State. If you really want to get one without providing any PII, get the line in a different State. Not providing information is the first step of limiting the blast radius of data leaks.
- fooqux 4y agoThis is not just about T-mobile. This problem is systemic.
- hot_gril 4y agoT-Mobile screams coupon-clipping to me, and that's the entire reason I've avoided it. Sounds stupid, but AT&T has been fine. Worth paying a little more.
- scarface74 4y agoAnd T-mobile is rumored to be taking away the autopay discount that they currently have unless you use a checking account instead of a credit card. There is no way in hell I’m giving T-mobile my checking account info.
- Stratoscope 4y agoNot a rumor, it is true. (I'm a T-Mobile customer and saw the notification on my account.)
- scarface74 4y agoI’ve seen that discussion on Reddit. But I still haven’t gotten a notification.
- Stratoscope 4y agoI didn't get a notification per se. It was when I signed into my account and went to the billing/autopay page that there was a banner at the top.
- everybodyknows 4y agoThey have however recently increased customer incentive to be on autopay, by bumping the penalty for late payment from $5 to $7.
- jabroni_salad 4y agoThey will also give the discount if you use a debit card. I'm pretty sure the reason for this is because FedNow launches this summer (usa is finally getting nationalized instant payments) and the qualifying information is your debit card or checking details.
- scarface74 4y agoA debit card is still linked to your checking account. That doesn’t help.
- blakesterz 4y agoHoly crap: "The incident is the second hack to hit T-Mobile this year. It’s the ninth since 2018, based on reporting by TechCrunch." Are there companies with a worse track record than this? Seems like they get breached way more than average.
- at-fates-hands 4y agoKeep in mind, these are the ones we know about. I would imagine there could be many, many more. I work for a large health care company. We've had several breaches already this year. None have been made public and users were never notified. Unless the press or some independent researcher like Krebs digs something up, its often times rare a company will make this stuff public.
- piffey 4y agoGo do a year in IR if you want some inside perspective -- and to shave a few years off your existence. Sounds about normal for a large telecommunications firm. These large firms don't have 30+ person IR teams on round the clock shifts distributed worldwide because nothing ever happens. T-Mobile just has some transparency and likely actual monitoring in place to detect these breaches instead of them just floating by until some threat actor sells the data somewhere public.
- kornhole 4y agoI use their network via Mint is because they do not require any ID. I buy SIM cards with cash. Breaches like this don't matter for me since they have no personal information.
- pdxandi 4y agoDoes that mean you keep changing your phone number with mew SIM cards? Or can/do you port it each time?
- SparkyMcUnicorn 4y agoYou only need to buy the sim once, but even if you kept buying new sims you can port your number each time.
- kornhole 4y agoI only use the SIM card for data. I do not know what phone number is on the SIM and would never use it. Instead I use VOIP for OTA calls and SMS.
- JustBreath 4y agoMy concern would be something more like getting 2FA codes stolen.
- mattl 4y agoDon't they need your address for E911?
- hnburnsy 4y agoOnly if you set up wifi calling.
- 8organicbits 4y agoT-Mobile also has (had?) an issue of poorly secured customer service devices. I'd consider each of those instances to be a breach, although at a smaller scale. https://github.com/n0sec1/n0sec-blog/blob/main/data/blog/how-to-rob-a-mobile-carrier.mdx https://github.com/n0sec1/n0sec-blog/blob/main/data/blog/how...
- flanbiscuit 4y ago> The information obtained for each customer varied but may have included full name, contact information, account number and associated phone numbers, T-Mobile account PIN, social security number, government ID, date of birth, balance due, internal codes that T-Mobile uses to service customer accounts (for example, rate plan and feature codes), and the number of lines wow, pretty much everything. great. How have they not learned from the last SEVEN times?! Can they be sued for this? Can they be fined by the government for this? I just logged in and when I tried going to my profile section I just got a screen that said "Access restricted". Maybe because I'm logging in from my work laptop which I've never done before. I guess this is how they are trying to deal with the issue, preventing access of sensitive info from "suspicious" logins.
- kahrl 4y agoYou can sue, but you'll need to wait until you suffer damages. And good luck proving that it was in fact THIS breach that caused your identity theft. The system is broken. There is no accountability whatsoever. You have no power to change any of this. It's all fucked.
- ajmurmann 4y agoThis would be a lot less problematic if we in the US wouldn't constantly use an ID as a authentication secret. Usage of social security numbers as a auth secret needs to be treated as a national emergency. Won't happen though because most our Congress people are geriatric and don't understand technology and the industry would push back on any change because it would cost then money.
- function_seven 4y agoI used to "half-joke" about wanting everyone's SSN published in one big fat breach. I don't joke about it now. I really do want every single SSN to be published somewhere with the associated identities. It seems like nothing short of that will convince banks and other sensitive institutions to give up on using it as a secret. Then, once the SSN can't be plausibly relied upon to authenticate people, these industries will have to do the hard work themselves.
- ok_coo 4y agoRemember, a fine (typically insufficient) is just a measured cost of doing business. How many times is it going to take for them to actually take this seriously?
- zubiaur 4y agoThis seems to be happening very often. Boost mobile got (allegedly) ransomwared a few months ago. There customer facing systems were down for more than a week. It’s a mess.
- glitcher 4y ago> affected 836 customers This number seems oddly low. My first instinct is not to trust that this was reported honestly. But if it is accurate, why was it so low? Perhaps there's something else very interesting about this breach they're not disclosing (not that they would provide more than the bare minimum amount of information required anyways).
- post_break 4y agoI read somewhere that new security protocols at T-Mobile stopped it. Accounts can only access a certain amount of data before it's locked out.
- nonfamous 4y agoThe announcement was from the Maine AG. I presume these are all customers in Maine. It’s likely customers in other states were affected as well, but this has not been announced.
- underyx 4y agoThe announcement also says only 1 Maine resident was affected.
- JohnTHaller 4y agoOh goodie. I'm still dealing with identity theft from T-Mobile's earlier breach.
- rickdeckard 4y ago> "Hack affecting 836 subscribers lasted for more than a month before it was discovered." The intrusion lasted that long and only data of 836 subscribers was affected? That's a weirdly low figure for having over a MONTH of access to their systems. What did they hack, a barely used fax-machine?
- bearjaws 4y agoCould be just high value celebrity targets to ensure a small surface area with the highest value.
- aboringusername 4y agoRemember this will happen again and again and again and again and again and again and again and again and again until America actually gets some proper data protection/privacy laws. You should consider all your data insecure and expect it to be breached at some point - as soon as it leaves your device you are no longer in control. I can't imagine a provider being hacked in the EU 9 times being able to get away with not changing its practices/being fined into oblivion.
- notyourwork 4y agoNo one cares, stock price continues to explode relative to telecom competitors. What incentive does TMobile need to resolve this nonsense?
- Bhilai 4y agoPretty much this. I cant seem to find it now but I read a study late last year that data breaches/hacks have almost no impact to the share price, no impact on customer base and consequently no impact to the leadership of a company. Thus, leadership is less likely to invest in security and privacy of their users.
- ajmurmann 4y agoAll my data has been leaked so often now by various companies, including my W2 when a past employer got spear phished. Meanwhile I have a really good contract with T-Mobile and been very happy with the service. Both in terms of connectivity and in-store service. While I'm upset about this, I'm not gonna go through the hassle of moving to a different service provider, all of whom have bad reputations anyways.
- thayne 4y agoThis is one of my big concerns with T-mobile acquiring Mint (or any other provider). T-mobile has a terrible track record for security, and companies that it acquires will likely inherit some of those vulnerabilities.
- tzs 4y agoI would not be surprised if T-Mobile keeps Mint's systems separate from their current systems. They haven't even figured out how and/or have no interest in being able to handle T-Mobil prepaid and T-Mobile postpaid from the same system, so I doubt that they will be able to fold in an outside system. Seriously, when I switched from T-Mobile postpaid to T-Mobile prepaid it was like changing carriers. New SIM, different website, mobile app does not work with prepaid accounts [1], different payment methods accepted, and more. If it weren't for the branding and the prepaid website being a subdomain of t-mobil.com someone looking at both would not guess that they are the same company. [1] It says "Sorry we're not ready for you. We're working on improving your app experience". It's been that way for many years, and whenever anyone asks about it on the T-Mobile forums someone from T-Mobile says they are working on it.
- avgDev 4y agoHire security consultant. Make some bare minimum changes due to budget constraints. Get hacked again. Make a statement. Hire security consultant. ....
- darksaints 4y agoLol, maybe the second line should be “Make changes that destroy programmer productivity while doing nothing to address security, and claim that it is a new security policy”. T-mobile didn’t pioneer the concept of using offshore fraudulent contractors and consultants to build your core IT infrastructure, but they certainly perfected it.
- GartzenDeHaes 4y agoT-Mobile must have very good security to be able to detect these breaches. Most companies (and government) have terrible security and just assume everything is fine because they never hear about any problems. Of course, you will never hear about any problems if you have no active detection and investigation capability.
- ed25519FUUU 4y agoThe worst thing about having your SSN leaked in a breach is that you can’t get a long-term credit lock until after you’ve already suffered identity theft. You need to show evidence you’ve had your identity stolen before you can safely prevent it from happening. The whole industry is exactly backwards.
- runamok 4y agoWhat do you mean by "long-term credit lock"? I think this should do what you want and I think it's free: https://www.usa.gov/credit-freeze https://www.usa.gov/credit-freeze
- whoopdedo 4y agoConspiracy theory: These hacks are being carried out by Experian to force T-Mobile into buying more credit monitoring for affected customers.
- anotheruser13 4y agoI used to work for T-Mobile. I suspect that they get breached so often due to age of one of their primary billing systems, which is written in PowerBuilder.
- mattanimation 4y agoI had just started using Mint mobile and then I find out a month later that T-Mobile is acquiring them, now this... there was a reason I never wanted to use T-Mobile. Guess I gotta find another provider... again
- Arrath 4y agoLast I heard the DoJ was considering filing suit to stop the acquisition, so maybe you won't have to?